Check Point Software Technologies Ltd.

Emc IP Holding Company LLC

F5 Networks, Inc.

Dan Karpati

Eyal Kolman

Barak Kfir

Nofar Bardugo

Alon Kaufman

Ron Talmor

Gennady Dosovitsky

Kineret Raviv

Tamir Zegman

Eitan Shterenbaum

Dmitry Rovniaguin

Erez Israel

Assaf Mendelson

Ofri Mann

Eugene Gulko

Lior Goldman

Eliyahu Hanokh Sandler

Moisey Sidgiyayev

Yotam Ahrak

Elena Root

Amir Harush

Assaf Jacob Mendelson

A computer device (referred to as a processing engine), system, and method are provided for refactoring an original security policy using an artificial intelligence (AI) engine including a large language model (LLM). The processing engine parses policy data converts the original security policy into a code representation and sends the converted code representation to the AI engine. The AI engine analyzes the original security policy by applying the LLM to the code representation and identifies policy insights that are sent to the processing engine.

Security policy refactoring using AI

Methods and devices are provided for differentiating between benign DNS data and malicious DNS data included in DNS traffic using an autoencoder. The autoencoder receives input DNS data and is trained to successfully encode the input DNS data when the input DNS data is benign DNS data and to fail to encode the input DNS data when the input DNS data is malicious DNS data. The autoencoder is trained using a modified loss function having a large weight when successfully encoding malicious DNS data.

DNS tunneling detection and prevention

A device, method, and system are provided for improving user interactions with large language models (LLMs) by enhancing user queries. User queries are enhanced by retrieving if/then pairs from a database that are related to the user query. The query is matched to related if statements stored in the database and the then statements of the matched if statements are included with the query to generate improved answers from the LLM.

Dynamic AI tester with feedback-driven learning

There are disclosed techniques for use in providing security in a computer network. In one embodiment, the techniques comprise a method including multiple steps. The method comprises receiving user access data characterizing user access with a protected resource within a computer network. The method also comprises evaluating the user access data to extract information therefrom that describes user access with respect to a feature of user access. The method also comprises determining a cardinality value in connection with the feature based on the extracted information and a maximum cardinality threshold. It should be appreciated that the cardinality value is limited by the maximum cardinality threshold such that the cardinality value cannot exceed the maximum cardinality threshold. The method also comprises presenting the cardinality value for facilitating fraud detection.

Method, apparatus and non-transitory processor-readable storage medium for providing security in a computer network

Methods and apparatus are provided for detecting suspicious network activity by new devices. An exemplary method comprises: obtaining network event data for a given entity that comprises a user or a user device; determining a number of distinct other entities associated with the given entity during a predefined short time window, wherein the distinct other entities comprise user devices used by the user if the given entity comprises a user and comprise users of the user device if the given entity comprises a user device; determining a number of distinct other entities associated with the given entity during a predefined longer time window; and assigning a risk score to the given entity based on (i) the number during the predefined short time window relative to the number during the predefined longer time window, and/or (ii) the number during the predefined short time window relative to a predefined number.

Methods and apparatus for detecting suspicious network activity by new devices

Embodiments are directed towards managing communication over a network assist application classification using predicted subscriber behavior. Subscriber information associated with a network flow may be determined. Prediction information that includes application identifiers may be generated based on the subscriber information. A classification engine may determine the applications associated with the network flow based on the prediction information and the network flow using a plurality of application classifiers that correspond to the applications. If an application identifier included in the prediction information is correspondent to an application classifier, the application may be determined based on the correspondent application classifier; otherwise the application is determined based on the remainder of the application classifiers. A policy for managing the network flow may be determined based on the determined application. Then the network traffic associated with the network flow may be communicated based on the at least one determined policy.

Assisting application classification using predicted subscriber behavior

Growing community of inventors

Even-Yehuda, Israel

Dan Karpati